andrewkroh/fleetpkg-mcp

fleetpkg-mcp

fleetpkg-mcp is a Model Context Protocol (MCP) server that enables LLMs to query metadata about Elastic Fleet integration packages. It loads metadata from a local copy of the elastic/integrations repository into a SQLite database and exposes query capabilities through the Model Context Protocol.

Features

• Indexes all Elastic Fleet packages (integration, input, and content) from your local elastic/integrations repository
• Creates a queryable SQLite database with comprehensive package metadata including fields, pipelines, transforms, variables, and test configurations
• Full-text search over package documentation, changelog entries, security detection rules, and ECS field definitions using SQLite FTS5 with porter stemming
• ECS field discovery and matching — search ~1990 ECS fields by concept or check field names against ECS to identify external: ecs candidates
• Exposes seven MCP tools: schema discovery, arbitrary SQL queries, doc search, changelog search, security rule search, ECS field search, and ECS field matching
• Periodic background refresh with optional git pull to keep data current
• Kubernetes-ready with /healthz and /readyz health check endpoints

Installation

Requires Go. No install step needed — MCP clients run it directly with go run.

Docker

The Docker image includes git and automatically clones the integrations repository on first run. It listens on HTTP port 8080 and refreshes every 24 hours by default:

docker run -p 8080:8080 -v fleetpkg-data:/data \
  -e FLEETPKG_MCP_REFRESH_INTERVAL=1h \
  ghcr.io/andrewkroh/fleetpkg-mcp:latest

Environment Variables

MCP Server Setup

The server requires a local checkout of the elastic/integrations repository.

Claude Code / Claude Desktop

claude mcp add --scope user fleetpkg -- go run github.com/andrewkroh/fleetpkg-mcp@latest -dir /path/to/integrations

Other MCP Clients

{
  "mcpServers": {
    "fleetpkg": {
      "command": "go",
      "args": [
        "run",
        "github.com/andrewkroh/fleetpkg-mcp@latest",
        "-dir",
        "/path/to/integrations"
      ]
    }
  }
}

HTTP Transport

For HTTP-based clients, start the server separately then point your client at the URL:

go run github.com/andrewkroh/fleetpkg-mcp@latest -dir /path/to/integrations -http 127.0.0.1:8080

MCP Tools

CLI Flags

Required

Optional

Database Schema

The database is built by go-package-spec/pkgsql, which reads packages using pkgreader and writes them into a self-documenting SQLite schema. For the complete schema, see schema.sql.

Tables

Example Conversations

Q: Use the fleetpkg tools to answer: What integrations configure a pivot type transform?

A: The following integrations configure a pivot type transform:

• aws_billing
• beaconing
• ded
• elasticsearch
• lmd
• pad

Q: Of those, which do not have an ingest node pipeline associated with the transform?

A: The integrations that configure a pivot type transform and do not have an ingest node pipeline associated with the transform are:

• lmd
• pad

Q: What github team owns those two integrations?

A: The elastic/sec-applied-ml GitHub team owns both the lmd and pad integrations.

Q: Use the fleetpkg tools to answer the following question. What integration data streams define a 'resource' field? And what are the data types of the fields?

A: The following integration data streams define a 'resource' field of type 'keyword':

• endace > flow
• network_traffic > amqp
• network_traffic > cassandra
• network_traffic > dhcpv4
• network_traffic > dns
• network_traffic > flow
• network_traffic > http
• network_traffic > icmp
• network_traffic > memcached
• network_traffic > mongodb
• network_traffic > mysql
• network_traffic > nfs
• network_traffic > pgsql
• network_traffic > redis
• network_traffic > sip
• network_traffic > thrift
• network_traffic > tls

Q: Analyze the screenshots to determine the percentage of screenshots that have the correct 'size' column in comparison to the computed width and height column values. Include the total numbers as well.

A: Based on my analysis of the screenshots in the database, here are the results:

Summary Statistics

• Total screenshots: 932
• Correct size values: 169 (18.13%)
• Incorrect size values: 763 (81.87%)

Analysis

Only 18.13% of screenshots have the correct 'size' column value that matches the computed dimensions from the width and height columns. This means that 81.87% of the screenshots have mismatched or incorrect size specifications.

Common Issues Found

Looking at the sample data, I can see several types of mismatches:

1. Placeholder values: Many screenshots have size="600x600" when the actual dimensions are different (e.g., 1920x1080, 1899x2069, 1920x1233)
2. Scaled/resized values: Screenshots show evidence of being resized - the size column contains smaller dimensions than the actual image dimensions (e.g., size shows 1896x961 but actual is 2880x1800)
3. Character encoding issues: At least one case shows size="1608x2692" (using x instead of x) while computed is "1608x2692"
4. Minor width discrepancies: Some have small differences in width (e.g., size="1280x1329" vs computed "1268x1329")

Q: Use the fleetpkg MCP tool. Analyze the number of 'set' ingest processors that use the 'copy_from' attribute vs the 'value' attribute with a Mustache template value matching '{{%}}'

A: Here are the results of the analysis of 'set' ingest processors:

• Number of processors using the copy_from attribute: 6992
• Number of processors using the value attribute with a Mustache template: 1174

Q: What are the top 5 teams responsible for the packages using 'set' with a Mustache template instead of 'copy_from'?

A: Here are the top 5 teams using 'set' with a Mustache template instead of 'copy_from':

1. elastic/security-service-integrations: 395 uses
2. elastic/integration-experience: 321 uses
3. elastic/obs-infraobs-integrations: 245 uses
4. elastic/obs-ds-hosted-services: 100 uses
5. elastic/elastic-agent-data-plane: 36 uses

License

This project is licensed under the Apache License 2.0 - see the LICENSE.txt file for details.